domains / families / security / password-spray-methodology

password-spray-methodology

separate

End-to-end password spray playbook. User enumeration, lockout detection, password pattern generation, spray execution across all protocols, error code differentials, and engagement discipline. Unifies M365/Entra, Okta, Exchange, Kerberos, SharePoint, XMLRPC, OIDC, and AD SMB/WinRM spraying into one methodology.

When to use

• Starting ANY engagement with a user list but no credentials
• Finding internet-facing login portals (OWA, Okta, ADFS, VPN, SSO, OIDC)
• After `hunt-ntlm-info` reveals AD domain/UPN format — feed into spray
• After `hunt-ldap` enumerates sAMAccountNames — feed into spray
• After `js-secrets-extraction` finds email patterns — feed into spray
• OneDrive 302/404 enum (from `m365-entra-attack`) confirms licensed users — spray them
• Any leaked credential dump from client — validate against all services
• Active-attacker detection via Smart Lockout differential

When not to use

• Protocol-specific deep dives

Skill page

Source